Tencent Cloud Third-party Payment Service Cannot Connect to Tencent Cloud CDB Externally: Security Group & Whitelist Checklist

If Tencent Cloud CDB is reachable from one network but not another, the problem is usually not “the database is down.” In real operations, the failure is more often one of these: the wrong source IP was whitelisted, the instance has no public endpoint, the security group is blocking the path, the account is in overdue or review status, or the client is connecting from a different egress IP than the one you added.

This checklist is written for people who need to buy, activate, fund, renew, and actually use a Tencent Cloud CDB instance, not just read theory. If you are trying to connect from a laptop, office network, jump server, or overseas office, the sections below will help you isolate the issue quickly.

First, narrow the problem in 3 minutes

Checklist before you touch network rules: account status matters

A surprising number of “CDB connection” cases start earlier than the database itself. If your cloud account is not in a healthy state, you may waste time debugging the wrong layer.

1) Make sure the account can actually place and keep the order

• KYC / identity verification completed: many international accounts cannot fully purchase or raise limits until verification is approved.
• Billing profile is consistent: the company name, cardholder name, and region should not look unrelated. Mismatches often trigger manual review.
• No pending risk-control review: frequent failed payments, unusual login locations, and rapid order attempts can trigger a hold.

Tencent Cloud Third-party Payment Service In practice, the fastest first-time purchasing success is usually with a real company card or a card that matches the verified billing identity. Prepaid cards, virtual cards, and cards with repeated charge failures are more likely to be flagged. If you are buying from outside the account’s main billing region, expect more scrutiny.

2) Funding and renewals can break connectivity later

Connection failures are not always a network problem. If the account balance is insufficient or auto-renew fails, the instance may enter an overdue state, and service behavior can change. I have seen teams spend hours on whitelist debugging only to discover the instance had already passed its renewal deadline.

• Turn on auto-renew for production databases.
• Set a billing alert at least 7–14 days before expiry.
• Keep a second payment method ready if the primary card expires or fails 3D Secure verification.
• If your procurement process uses bank transfer, expect slower activation and a longer gap before the instance is fully usable.

External connection checklist for Tencent Cloud CDB

The most common mistake is changing only one layer and assuming the whole path is open. For external access, you need the source IP, database whitelist, security group or proxy rules, port, and instance status to all line up.

Step 1: Confirm whether you are connecting directly or through a jump path

• Direct Internet access: you need a reachable public endpoint and the client IP must be whitelisted.
• Via CVM / bastion / VPN: the public Internet may not be involved; the source-side security group and routing rules become part of the chain.
• Private network only: if the instance is meant for intranet use, you cannot connect from a laptop at home unless you build a secure tunnel first.

If you are unsure, look at the address you are actually using in the client. Many teams think they are connecting “from the office network,” but the traffic may be going through a proxy, VPN, or NAT gateway that changes the visible source IP.

Step 2: Add the correct source IP to the database whitelist

This is the single most common failure point. The IP you add must be the public egress IP that Tencent Cloud sees, not your laptop’s local address such as 192.168.x.x or 10.x.x.x.

• Check your current public IP from the same network you will use to connect.
• If your office uses a shared NAT gateway, whitelist that gateway’s outbound IP, not the individual machine.
• If your home ISP changes IP frequently, a single-IP whitelist will keep breaking.
• Tencent Cloud Third-party Payment Service When in doubt, use a small CIDR range only if your security policy permits it.

Common mistake: adding the IP you see while connected to a corporate VPN, then trying to connect outside the VPN. The two paths often have different source addresses.

Step 3: Verify the port is really open end to end

The database port depends on the engine, but the important part is not the default number itself; it is whether your client, firewall, security group, and database all agree on the same port.

• MySQL-family instances commonly use 3306.
• SQL Server commonly uses 1433.
• Tencent Cloud Third-party Payment Service PostgreSQL commonly uses 5432.

If the port is blocked somewhere in the path, you will usually see a timeout rather than a clean login error. That distinction helps narrow down whether you are dealing with network filtering or credential problems.

Step 4: Check the security group only where it applies

Security group rules are often misunderstood. If you are connecting through a CVM, bastion host, VPN appliance, or proxy server, the security group on that source machine or access layer may block traffic before it ever reaches CDB. In that case, updating the database whitelist alone will not help.

• Confirm inbound rules on the source proxy or jump server.
• Confirm outbound rules if your organization restricts egress.
• Make sure route tables and NAT rules allow the traffic to leave and return correctly.

If you connect directly from the Internet, the database-side whitelist is usually the first thing to inspect. If you connect through internal infrastructure, think in terms of the full path, not just the database console.

Tencent Cloud Third-party Payment Service Step 5: Confirm the database instance is in a usable billing and service state

A CDB instance that is overdue, under review, or otherwise restricted can behave differently from a normal instance. Before deep-diving into network settings, check:

• Instance is running and not in a suspended or overdue state.
• Tencent Cloud Third-party Payment Service Renewal has been paid and confirmed.
• No security or compliance review is pending.
• Tencent Cloud Third-party Payment Service Database account and password are valid.

Payment methods: which one causes fewer surprises?

For first-time Tencent Cloud purchases, the payment method can affect how quickly the account is activated and whether the order gets reviewed. In the field, I usually see three patterns:

From a risk-control perspective, the most common triggers are: cardholder name mismatch, abnormal purchase location, repeated failed attempts, and new account ordering a high-value resource too early. If you want fewer delays, start with a small instance and complete usage history before scaling up.

Cost comparison: the cheapest way to connect is not always the cheapest to run

When users ask for “the cheapest way to access CDB externally,” they usually mean one of three things: lowest setup cost, lowest monthly cost, or lowest operational risk. Those are not the same answer.

In practice, teams often underestimate the hidden cost of “just open it to the Internet.” One incident caused by a wrong whitelist or leaked credential can cost more than a year of bastion-host expense. For production, I usually recommend using public access only as a temporary bridge, not as the default operating model.

Real-world failure patterns I see most often

Case 1: The IP was correct, but the office network changed

A SaaS team in Singapore added the developer’s office IP to the whitelist. It worked for two days and then failed again. The cause was not Tencent Cloud; the office firewall was rotating outbound addresses through a new NAT pool. Fix: whitelist the office NAT gateway range or move access through a stable VPN endpoint.

Case 2: The account was fine, but the payment failed silently

A new international account bought CDB with a card that did not pass 3D Secure on the first try. The order stayed pending, the team assumed the instance was active, and they started troubleshooting the network. Fix: verify the order is paid, not just submitted, and check whether the account is still under review.

Case 3: Whitelist updated, but the instance had no public path

A developer opened the CDB whitelist and still could not connect from home. The instance was only reachable through the VPC path, and there was no public endpoint enabled for that workflow. Fix: choose the correct access method before changing rules.

What to do if the connection still fails after the checklist

If you want support or a teammate to resolve this quickly, send the following information in one message. This avoids the back-and-forth that usually delays resolution by a day or more.

• Instance region and engine type
• Instance ID
• Connection method: direct Internet, VPN, bastion, CVM, or office network
• Source public IP at the time of failure
• Whitelist entry you added
• Port number used by the client
• Exact error message or timeout behavior
• Account billing status and whether renewal is due
• Whether the account recently completed KYC or triggered a review

This is enough to separate a network issue from a billing or compliance issue in most cases.

FAQ

Why can I connect from the CVM but not from my laptop?

The CVM path is usually private and already allowed. Your laptop’s public IP is different and may not be in the CDB whitelist. Also check whether the office or home network has outbound port restrictions.

Why does “security group allowed” not fix it?

Because security group settings are only one part of the path. If the CDB whitelist does not include your real source IP, or the instance has no public path, the connection still fails.

Can I whitelist my home IP once and forget it?

Only if your ISP gives you a stable address. Many home networks change public IPs after router reboot, lease renewal, or ISP-side changes. If you need reliable access, use a VPN or bastion host.

Will renewal failure affect external connections?

Yes. In overdue or restricted states, access behavior can change fast. Don’t wait until the last day; keep auto-renew enabled for production and set reminders before expiry.

Does incomplete identity verification block CDB purchase or use?

It often does, especially for new international accounts or higher-value purchases. Even if a small order goes through, later scaling, billing changes, or certain region-specific actions may still require verification.

Which payment method causes the fewest risk-control issues?

In day-to-day operations, a card that matches the verified billing identity and passes 3D Secure cleanly usually causes the fewest delays. Bank transfer is more predictable for procurement, but it is slower. Virtual or prepaid cards are more likely to trigger checks.

Practical decision guide

If you are choosing how to set up access for the next 30 days, use this rule:

• Testing only: direct public access + strict whitelist is acceptable.
• Team access: use VPN or bastion and keep the database private.
• Production: favor private access paths, enable auto-renew, and keep billing and KYC in good standing.

The fastest fix is not always the safest operating model. Most repeated “cannot connect” incidents are not technical accidents; they are configuration drift, billing delays, or IP changes that were never documented. If you clean up the whitelist process, keep the account healthy, and choose a stable access path, Tencent Cloud CDB becomes much easier to operate in real life.